Essentially, I'm wondering how difficult or possible it would be to do a core-dump on an already running process that was started without a debugger.

I have a video that I opened in VLC (and is still running in VLC). I accidentally, however, deleted the original file but to my surprise, was still able to scroll back and forth on in VLC (making me think it's still in memory).

Would it somehow be possible to do a core dump of the running process from it's PID and somehow piece together the data? Would that likely involve me following pointers through data-structures that I would need to sift through VLC's source code for?

I'm running OSX right now (so BSD). I think you could do a core-dump on processes with gdb if it was started alongside the debugger, but I'm not sure about trying to do it with processes already running (as I'm sure the OS would also not like that).

Any ideas?

I would add the tag "core-dump" but I don't have enough points.

  • @blabb try it on OS X
    – Igor Skochinsky
    Jan 8 '18 at 12:21
  • @igor since you recommend to try osx illl assume it is possible to delete files in use in osx so deleting my earlier cimment
    – blabb
    Jan 8 '18 at 12:56

Well since your VLC is still running the easiest to recover your file will be fire up "View" -> "Advanced controls" and re-record the entire file. You should find a vlc-record-... somewhere in your homefolder.

To answer your question, you can attach to a running process with attach <pid> in a gdb shell without argument(s).

Use detach to return execution to vlc.

memory can be dumped with dump binary memory result.bin start-addr end-addr (see http://sourceware.org/gdb/onlinedocs/gdb/Dump_002fRestore-Files.html) but it's highly unlikely your entire file will be in memory, it probably still works because the file descriptor is still open.

As a small disclaimer, you probably only got 1 shot at this. As soon as the file descriptor is closed (this will probably happen when VLC reaches end of file and gets into 'stopped' state or if the gdb does something unintended) your file will be lost - so you might want to try those steps first on a new / different file, preferably on a different Mac.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.